feat!: universal redesign — drop Minecraft stack, single-crate architecture
- remove Java plugins (velocity/paper), dashboard, all MC-specific code
(handshake, death_code, varint, hostname-HMAC); available in history pre-v0.2
- merge crates/* into one package with src/bin/{rampart,rampart-manager,rampart-cli}
- ProtocolHandler trait + registry (no implementations yet), universal PoW kept
- XDP: universal L3/L4 filter (xdp/core/) + pluggable hook API (xdp/hooks/),
fix IPv6 saddr bug; clang build verified
- docs: bilingual knowledge base (docs/kb/: attacks x4, defense-levels,
practice x3), rewrite README/architecture for universal concept
- TODO.md v4.0: <=300-line module limit, competitor benchmark section (ref/)
- deploy/CI/docs cleanup: no MC references, new binary names
cargo build/clippy(-D warnings)/test green (55 tests)
This commit is contained in:
parent
0b53ed720b
commit
15f474486a
GPG key ID:
253067914055423B
179 changed files with 5044 additions and 11519 deletions
|
|
@ -8,113 +8,66 @@
|
|||
|
||||
```
|
||||
attacker ──┐
|
||||
├── rampart-edge ── backend
|
||||
│ (XDP отключён в тестах,
|
||||
│ используется userspace-only режим)
|
||||
│
|
||||
mclient ───┘ (Minecraft клиент для теста легитимных коннектов)
|
||||
├── rampart-edge ── backend (TCP echo stub)
|
||||
legit ─────┘ (XDP отключён в тестах,
|
||||
используется userspace-only режим)
|
||||
```
|
||||
|
||||
## Быстрый старт
|
||||
|
||||
```bash
|
||||
# 1. Сеть
|
||||
docker network create rampart-test
|
||||
|
||||
# 2. Backend (Minecraft сервер или заглушка)
|
||||
docker run -d --name backend --network rampart-test itzg/minecraft-server
|
||||
|
||||
# 3. Rampart edge
|
||||
docker run -d --name rampart --network rampart-test \
|
||||
-e RAMPART_CONFIG=/etc/rampart/config.toml \
|
||||
-v ./config.test.toml:/etc/rampart/config.toml \
|
||||
rampart-core
|
||||
|
||||
# 4. Аттакер (MHDDoS)
|
||||
docker run -d --name attacker --network rampart-test \
|
||||
--cap-add=NET_RAW --cap-add=NET_ADMIN \
|
||||
python:3.11 bash -c "while true; do sleep 10; done"
|
||||
|
||||
# 5. Легитимный клиент (mclient.py)
|
||||
docker run -d --name mclient --network rampart-test \
|
||||
python:3.11 python mclient.py --target rampart:25565
|
||||
# 1. Сборка + сеть + backend + edge + attacker
|
||||
bash deploy/test/run_test.sh
|
||||
```
|
||||
|
||||
Скрипт поднимает:
|
||||
- `backend` — TCP echo-заглушка на 25566;
|
||||
- `rampart` — edge-нода с конфигом `config.test.toml`;
|
||||
- `attacker` — контейнер с python3 для запуска `stress/flood.py`.
|
||||
|
||||
## Сценарии тестирования
|
||||
|
||||
### 1. SYN flood
|
||||
### 1. TCP connection flood (CPS)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py SYN 172.x.x.x:25565 60 100
|
||||
docker exec attacker python3 /flood.py --target rampart --port 25565 \
|
||||
--mode connect --duration 30 --threads 50
|
||||
```
|
||||
Ожидание: Rampart XDP дропает SYN-пакеты после превышения throttle.
|
||||
Метрика: `rampart_xdp_syn_throttle` растёт, CPU < 30%.
|
||||
|
||||
### 2. TCP connection flood (CPS)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py CPS 172.x.x.x:25565 60 100
|
||||
```
|
||||
Ожидание: Rampart rate-limiter блокирует >50 conn/s с одного IP.
|
||||
Ожидание: rate-limiter блокирует превышение лимита коннектов с одного IP.
|
||||
Метрика: `rampart_rate_limit_hits` растёт.
|
||||
|
||||
### 3. Minecraft handshake flood
|
||||
### 2. Slowloris (медленные соединения)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py MINECRAFT 172.x.x.x:25565 60 100
|
||||
docker exec attacker python3 /flood.py --target rampart --port 25565 \
|
||||
--mode slowloris --duration 30 --threads 200
|
||||
```
|
||||
Ожидание: Layer 2 PoW требует решения хэш-задачи.
|
||||
Метрика: `rampart_pow_challenges_total{result="failed"}` растёт.
|
||||
|
||||
### 4. Сложный ботнет (MHDDoS MCBOT)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py MCBOT 172.x.x.x:25565 60 50
|
||||
```
|
||||
Ожидание: Physics check детектирует неестественное движение.
|
||||
Требует: PhysicsCheckListener активен.
|
||||
|
||||
### 5. DNS amplification
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py DNS 172.x.x.x:53 60 100
|
||||
```
|
||||
Ожидание: XDP дропает UDP не на порты 25565-25575.
|
||||
Метрика: `rampart_xdp_dropped` растёт.
|
||||
|
||||
### 6. Slowloris (L7)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py SLOW http://172.x.x.x:9090 60 100
|
||||
```
|
||||
Ожидание: Таймаут чтения закрывает соединение.
|
||||
Ожидание: таймаут чтения (`limits.handshake_timeout_secs`) закрывает соединения.
|
||||
Метрика: `rampart_connections_total{result="blocked"}` растёт.
|
||||
|
||||
### 7. HTTP flood через cloudscraper (имитация CFB)
|
||||
### 3. SYN flood (raw, требует hping3 или отдельный контейнер)
|
||||
```bash
|
||||
docker exec attacker python3 /ref/MHDDoS/start.py CFB http://172.x.x.x:9090 60 100
|
||||
hping3 -S --flood -p 25565 <EDGE_IP>
|
||||
```
|
||||
Ожидание: L7 rate-limiter блокирует >100 req/s с одного IP.
|
||||
Метрика: `rampart_rate_limit_hits` растёт.
|
||||
Ожидание: обрабатывается kernel'ом; при включённом XDP — дропается в ядре.
|
||||
|
||||
## Легитимный тест (mclient.py)
|
||||
## Легитимный клиент
|
||||
|
||||
Тест должен проходить: Rampart пропускает нормальный Minecraft handshake.
|
||||
Во время атаки параллельно проверяем, что обычные клиенты проходят:
|
||||
|
||||
```bash
|
||||
python3 deploy/test/mclient.py --target rampart:25565 --username test_player
|
||||
python3 deploy/test/stress/legit.py --target localhost --port 25565
|
||||
```
|
||||
Ожидание: HMAC verified, соединение проксируется на backend.
|
||||
|
||||
## Метрики
|
||||
|
||||
Все метрики на http://localhost:9090/metrics:
|
||||
|
||||
```
|
||||
rampart_xdp_total
|
||||
rampart_xdp_passed
|
||||
rampart_xdp_dropped
|
||||
rampart_xdp_syn_throttle
|
||||
rampart_xdp_verified
|
||||
rampart_connections_total{result="allowed|blocked"}
|
||||
rampart_rate_limit_hits{action="hit"}
|
||||
rampart_rate_limit_hits
|
||||
rampart_pow_challenges_total{result="passed|failed|skipped"}
|
||||
rampart_pow_current_difficulty
|
||||
rampart_attack_status
|
||||
```
|
||||
|
||||
Grafana: http://localhost:3000 (admin/admin)
|
||||
ClickHouse: http://localhost:8123 (для долгосрочных метрик)
|
||||
ClickHouse (опционально): http://localhost:8123 — долгосрочное хранение событий.
|
||||
Grafana: http://localhost:3000 (admin/admin) — дашборды из `deploy/grafana/`.
|
||||
|
|
|
|||
|
|
@ -3,43 +3,36 @@ address = "0.0.0.0"
|
|||
port = 25565
|
||||
|
||||
[backend]
|
||||
address = "backend"
|
||||
port = 25565
|
||||
upstreams = ["backend:25566"]
|
||||
|
||||
[hmac]
|
||||
secret = "test-secret-for-local-dev-only"
|
||||
|
||||
[worker]
|
||||
[workers]
|
||||
count = 4
|
||||
|
||||
[limits]
|
||||
rate_limit_login_pps = 50
|
||||
rate_limit_burst = 100
|
||||
handshake_timeout_secs = 5
|
||||
max_connections_per_ip = 10
|
||||
rate_limit_pps = 50.0
|
||||
rate_limit_burst = 100.0
|
||||
|
||||
[store]
|
||||
redis_url = ""
|
||||
blacklist_cache_ttl_secs = 300
|
||||
clickhouse_url = "http://clickhouse:8123"
|
||||
|
||||
[xdp]
|
||||
enabled = false
|
||||
interface = "eth0"
|
||||
|
||||
[death_code]
|
||||
enabled = true
|
||||
|
||||
[minecraft]
|
||||
ping_timeout_ms = 5000
|
||||
handshake_timeout_ms = 10000
|
||||
|
||||
[metrics]
|
||||
enabled = true
|
||||
port = 9090
|
||||
|
||||
[logging]
|
||||
level = "debug"
|
||||
format = "text"
|
||||
|
||||
[pow]
|
||||
enabled = true
|
||||
enabled = false
|
||||
difficulty = 4
|
||||
|
||||
whitelist = ["127.0.0.1", "::1"]
|
||||
|
|
|
|||
|
|
@ -1,73 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Minecraft handshake client for testing Rampart."""
|
||||
|
||||
import argparse
|
||||
import socket
|
||||
import struct
|
||||
import time
|
||||
|
||||
|
||||
def pack_varint(value):
|
||||
buf = []
|
||||
while True:
|
||||
byte = value & 0x7F
|
||||
value >>= 7
|
||||
if value:
|
||||
byte |= 0x80
|
||||
buf.append(byte)
|
||||
if not value:
|
||||
break
|
||||
return bytes(buf)
|
||||
|
||||
|
||||
def make_handshake(host, port, protocol=767):
|
||||
packet = bytearray()
|
||||
packet.extend(pack_varint(protocol))
|
||||
packet.extend(pack_varint(len(host)))
|
||||
packet.extend(host.encode())
|
||||
packet.extend(struct.pack(">H", port))
|
||||
packet.extend(pack_varint(2))
|
||||
length = pack_varint(len(packet))
|
||||
return length + bytes(packet)
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("--target", default="localhost:25565")
|
||||
parser.add_argument("--username", default="test_bot")
|
||||
args = parser.parse_args()
|
||||
|
||||
host, port_str = args.target.split(":")
|
||||
port = int(port_str)
|
||||
|
||||
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sock.settimeout(10)
|
||||
sock.connect((host, port))
|
||||
sock.sendall(make_handshake(host, port))
|
||||
|
||||
data = sock.recv(4096)
|
||||
if data:
|
||||
print(f"Got response: {data.hex()}")
|
||||
# If PoW challenge -> receive challenge, solve, send nonce
|
||||
if b"challenge" in data:
|
||||
print("PoW challenge received")
|
||||
challenge = data.decode().strip()
|
||||
for nonce in range(1000000):
|
||||
import hashlib
|
||||
|
||||
h = hashlib.sha256(f"{challenge}{nonce}".encode()).hexdigest()
|
||||
if h.startswith("0000"):
|
||||
sock.sendall(str(nonce).encode())
|
||||
resp = sock.recv(4096)
|
||||
print(f"PoW ok, handshake: {resp.hex()}")
|
||||
break
|
||||
else:
|
||||
print(f"Handshake response: {data.hex()}")
|
||||
else:
|
||||
print("No response (blocked)")
|
||||
|
||||
sock.close()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
@ -4,50 +4,37 @@ set -euo pipefail
|
|||
NET="rampart-test"
|
||||
DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
|
||||
echo "=== Сборка rampart ==="
|
||||
cargo build --release --bin rampart
|
||||
|
||||
echo "=== Создание сети ==="
|
||||
docker network create "$NET" 2>/dev/null || true
|
||||
|
||||
echo "=== ClickHouse ==="
|
||||
docker rm -f clickhouse 2>/dev/null || true
|
||||
docker run -d --name clickhouse --network "$NET" \
|
||||
-v "$DIR/../clickhouse/schema.sql:/docker-entrypoint-initdb.d/schema.sql" \
|
||||
-p 8123:8123 \
|
||||
clickhouse/clickhouse-server:latest
|
||||
|
||||
echo "=== Grafana ==="
|
||||
docker rm -f grafana 2>/dev/null || true
|
||||
docker run -d --name grafana --network "$NET" \
|
||||
-p 3000:3000 \
|
||||
-e GF_INSTALL_PLUGINS=grafana-clickhouse-datasource \
|
||||
grafana/grafana:latest
|
||||
|
||||
echo "=== Backend (Minecraft stub) ==="
|
||||
echo "=== Backend stub (TCP echo) ==="
|
||||
docker rm -f backend 2>/dev/null || true
|
||||
# simple TCP echo server as placeholder
|
||||
docker run -d --name backend --network "$NET" \
|
||||
alpine sh -c "apk add socat && socat TCP-LISTEN:25565,fork EXEC:'cat'"
|
||||
alpine sh -c "apk add socat && socat TCP-LISTEN:25566,fork EXEC:'cat'"
|
||||
|
||||
echo "=== Rampart Edge ==="
|
||||
docker rm -f rampart 2>/dev/null || true
|
||||
TMPDIR=$(mktemp -d)
|
||||
cp "$DIR/../../target/release/rampart-core" "$TMPDIR/"
|
||||
cp "$DIR/../../target/release/rampart" "$TMPDIR/"
|
||||
cp "$DIR/../docker/Dockerfile.test" "$TMPDIR/Dockerfile"
|
||||
docker build -t rampart-core "$TMPDIR"
|
||||
docker build -t rampart "$TMPDIR"
|
||||
rm -rf "$TMPDIR"
|
||||
docker run -d --name rampart --network "$NET" \
|
||||
--cap-add=NET_ADMIN \
|
||||
-p 25565:25565 -p 9090:9090 \
|
||||
-e RAMPART_CONFIG=/etc/rampart/config.toml \
|
||||
-v "$DIR/config.test.toml:/etc/rampart/config.toml" \
|
||||
rampart-core
|
||||
rampart
|
||||
|
||||
echo "=== Attacker (MHDDoS) ==="
|
||||
echo "=== Attacker ==="
|
||||
docker rm -f attacker 2>/dev/null || true
|
||||
docker run -d --name attacker --network "$NET" \
|
||||
--cap-add=NET_RAW --cap-add=NET_ADMIN \
|
||||
-v "$DIR/../../ref/MHDDoS:/ref/MHDDoS" \
|
||||
python:3.11 bash -c "
|
||||
cd /ref/MHDDoS && pip install -r requirements.txt -q && \
|
||||
-v "$DIR/stress/flood.py:/flood.py:ro" \
|
||||
debian:bookworm-slim bash -c "
|
||||
apt-get update -qq && apt-get install -y -qq python3 iproute2 >/dev/null && \
|
||||
while true; do sleep 10; done
|
||||
"
|
||||
|
||||
|
|
@ -55,10 +42,10 @@ echo ""
|
|||
echo "=== Готово ==="
|
||||
echo "Rampart edge: localhost:25565"
|
||||
echo "Metrics: http://localhost:9090/metrics"
|
||||
echo "Grafana: http://localhost:3000 (admin/admin)"
|
||||
echo "ClickHouse: http://localhost:8123"
|
||||
echo ""
|
||||
echo "Пример атаки:"
|
||||
echo " docker exec attacker python3 /ref/MHDDoS/start.py TCP rampart:25565 60 100"
|
||||
echo " docker exec attacker python3 /flood.py --target rampart --port 25566 --mode connect --duration 30 --threads 50"
|
||||
echo "Легитимный клиент:"
|
||||
echo " python3 $DIR/stress/legit.py --target localhost --port 25565"
|
||||
echo ""
|
||||
echo "Для остановки: docker rm -f rampart backend attacker clickhouse grafana"
|
||||
echo "Для остановки: docker rm -f rampart backend attacker"
|
||||
|
|
|
|||
|
|
@ -1,237 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
"""DDoS simulation: 100 IPs from attacker container, 3 legit clients from host."""
|
||||
|
||||
import subprocess, time, re, sys
|
||||
|
||||
TARGET_IP = "172.18.0.6"
|
||||
TARGET_PORT = 25565
|
||||
METRICS_URL = "http://localhost:9090/metrics"
|
||||
DURATION = 30
|
||||
NUM_IPS = 100
|
||||
|
||||
|
||||
def metrics():
|
||||
try:
|
||||
import urllib.request
|
||||
|
||||
data = urllib.request.urlopen(METRICS_URL, timeout=5).read().decode()
|
||||
result = {}
|
||||
for line in data.splitlines():
|
||||
if line.startswith("rampart_"):
|
||||
parts = line.split()
|
||||
if len(parts) >= 2:
|
||||
result[parts[0]] = parts[-1]
|
||||
return result
|
||||
except:
|
||||
return {}
|
||||
|
||||
|
||||
def print_metrics(label, m):
|
||||
print(f" [{label}]", end="")
|
||||
for k, v in sorted(m.items()):
|
||||
print(f" {k}={v}", end="")
|
||||
print()
|
||||
|
||||
|
||||
ALLOWED = set("0123")
|
||||
|
||||
|
||||
def solve_pow(challenge, difficulty):
|
||||
import hashlib
|
||||
|
||||
t0 = time.time()
|
||||
for n in range(20_000_000):
|
||||
h = hashlib.sha256(f"{challenge}{n}".encode()).hexdigest()
|
||||
if all(c in ALLOWED for c in h[:difficulty]):
|
||||
return n, time.time() - t0
|
||||
return None, time.time() - t0
|
||||
|
||||
|
||||
def legit_client(client_id, delay):
|
||||
import socket, hashlib, struct
|
||||
|
||||
time.sleep(delay)
|
||||
m = metrics()
|
||||
diff = int(m.get("rampart_pow_current_difficulty", "4"))
|
||||
try:
|
||||
s = socket.socket()
|
||||
s.settimeout(10)
|
||||
s.connect(("localhost", TARGET_PORT))
|
||||
data = s.recv(4096).decode().strip()
|
||||
nonce, solve_t = solve_pow(data, diff)
|
||||
if nonce is None:
|
||||
print(f" [legit#{client_id}] FAILED to solve PoW (diff={diff})")
|
||||
s.close()
|
||||
return
|
||||
s.sendall(f"{nonce}\n".encode())
|
||||
time.sleep(0.1)
|
||||
|
||||
# MC handshake
|
||||
def wv(v):
|
||||
b = bytearray()
|
||||
while True:
|
||||
byte = v & 0x7F
|
||||
v >>= 7
|
||||
if v:
|
||||
byte |= 0x80
|
||||
b.append(byte)
|
||||
if not v:
|
||||
break
|
||||
return bytes(b)
|
||||
|
||||
host = "localhost"
|
||||
hs = bytearray()
|
||||
hs.extend(wv(0))
|
||||
hs.extend(wv(767))
|
||||
hs.extend(wv(len(host)))
|
||||
hs.extend(host.encode())
|
||||
hs.extend(struct.pack(">H", 25565))
|
||||
hs.extend(wv(2))
|
||||
s.sendall(wv(len(hs)) + bytes(hs))
|
||||
time.sleep(0.1)
|
||||
name = f"test_{client_id}"
|
||||
login = bytearray()
|
||||
login.extend(wv(0))
|
||||
login.extend(wv(len(name)))
|
||||
login.extend(name.encode())
|
||||
s.sendall(wv(len(login)) + bytes(login))
|
||||
resp = s.recv(4096)
|
||||
status = "OK" if resp else "no_resp"
|
||||
print(
|
||||
f" [legit#{client_id}] ✅ diff={diff} solve={solve_t:.3f}s status={status}"
|
||||
)
|
||||
except Exception as e:
|
||||
print(f" [legit#{client_id}] ❌ diff={diff} error={e}")
|
||||
finally:
|
||||
try:
|
||||
s.close()
|
||||
except:
|
||||
pass
|
||||
|
||||
|
||||
def run_flood_in_attacker():
|
||||
"""Run the 100-IP flood inside the attacker container."""
|
||||
print("[setup] Launching flood inside attacker container...")
|
||||
import os, tempfile
|
||||
|
||||
script = """
|
||||
import socket, threading, time, struct
|
||||
|
||||
TARGET = ("172.18.0.6", 25565)
|
||||
DURATION = 30
|
||||
NUM_IPS = 100
|
||||
sent = 0
|
||||
lock = threading.Lock()
|
||||
|
||||
def wv(v):
|
||||
b = bytearray()
|
||||
while True:
|
||||
byte = v & 0x7F
|
||||
v >>= 7
|
||||
if v: byte |= 0x80
|
||||
b.append(byte)
|
||||
if not v: break
|
||||
return bytes(b)
|
||||
|
||||
host = "localhost"
|
||||
handshake = wv(0) + wv(767) + wv(len(host)) + host.encode() + struct.pack(">H", 25565) + wv(2)
|
||||
end = time.time() + DURATION
|
||||
|
||||
def flood():
|
||||
global sent
|
||||
while time.time() < end:
|
||||
try:
|
||||
s = socket.socket()
|
||||
s.settimeout(5)
|
||||
s.connect(TARGET)
|
||||
s.sendall(wv(len(handshake)) + handshake)
|
||||
with lock: sent += 1
|
||||
s.close()
|
||||
except: pass
|
||||
|
||||
threads = [threading.Thread(target=flood) for _ in range(NUM_IPS)]
|
||||
for t in threads: t.start()
|
||||
for t in threads: t.join()
|
||||
print(f"FLOOD_DONE:{sent}")
|
||||
"""
|
||||
tmp = tempfile.mktemp(suffix=".py")
|
||||
with open(tmp, "w") as f:
|
||||
f.write(script)
|
||||
subprocess.run(f'docker cp "{tmp}" attacker:/tmp/flood.py', shell=True, check=True)
|
||||
os.unlink(tmp)
|
||||
result = subprocess.run(
|
||||
f"docker exec attacker python3 /tmp/flood.py",
|
||||
shell=True,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=DURATION + 20,
|
||||
)
|
||||
for line in result.stdout.splitlines():
|
||||
if "FLOOD_DONE" in line:
|
||||
return int(line.split(":")[1])
|
||||
print(" [flood] stdout:", result.stdout[-300:])
|
||||
print(" [flood] stderr:", result.stderr[-300:])
|
||||
return 0
|
||||
|
||||
|
||||
# ── Main ──
|
||||
print("=" * 60)
|
||||
print("Rampart DDoS Simulation — 100 IP Handshake Flood + Legit Clients")
|
||||
print("=" * 60)
|
||||
|
||||
before = metrics()
|
||||
print_metrics("BEFORE", before)
|
||||
|
||||
# Launch flood in attacker container
|
||||
flood_total = run_flood_in_attacker()
|
||||
|
||||
# Launch legit clients during flood
|
||||
import threading
|
||||
|
||||
legit3 = threading.Thread(target=legit_client, args=(3, 25))
|
||||
legit2 = threading.Thread(target=legit_client, args=(2, 15))
|
||||
legit1 = threading.Thread(target=legit_client, args=(1, 5))
|
||||
legit1.start()
|
||||
time.sleep(0.1)
|
||||
legit2.start()
|
||||
time.sleep(0.1)
|
||||
legit3.start()
|
||||
|
||||
# Poll metrics during attack
|
||||
for i in range(DURATION // 5):
|
||||
time.sleep(5)
|
||||
m = metrics()
|
||||
print_metrics(f"t={(i + 1) * 5}s", m)
|
||||
|
||||
legit1.join()
|
||||
legit2.join()
|
||||
legit3.join()
|
||||
time.sleep(2)
|
||||
|
||||
after = metrics()
|
||||
print_metrics("AFTER", after)
|
||||
|
||||
# Summary
|
||||
print()
|
||||
print("=" * 60)
|
||||
print("SUMMARY")
|
||||
print("=" * 60)
|
||||
diff = lambda k: int(after.get(k, "0")) - int(before.get(k, "0"))
|
||||
print(f" Total handshakes sent: {flood_total}")
|
||||
print(f" CPS: {flood_total // DURATION}")
|
||||
print(
|
||||
f" PoW challenges failed: +{diff('rampart_pow_challenges_total{result="failed"}')}"
|
||||
)
|
||||
print(
|
||||
f" PoW challenges passed: +{diff('rampart_pow_challenges_total{result="passed"}')}"
|
||||
)
|
||||
print(
|
||||
f" Connections allowed: +{diff('rampart_connections_total{result="allowed"}')}"
|
||||
)
|
||||
print(
|
||||
f" Connections blocked: +{diff('rampart_connections_total{result="blocked"}')}"
|
||||
)
|
||||
print(
|
||||
f" PoW difficulty (start): {before.get('rampart_pow_current_difficulty', '?')}"
|
||||
)
|
||||
print(f" PoW difficulty (end): {after.get('rampart_pow_current_difficulty', '?')}")
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# Стресс-тест Rampart на VDS (без Redis/Velocity/Paper)
|
||||
# Стресс-тест Rampart на VDS (без Redis/ClickHouse)
|
||||
|
||||
Проверяет edge ноду (слои 1–3) на реальном VDS. Не требует Redis, Velocity, Paper или ClickHouse — только `rampart-core` и stub-бэкенд (socat echo) в одном контейнере.
|
||||
Проверяет edge-ноду (слои 1–3) на реальном VDS. Не требует Redis, ClickHouse или внешних сервисов — только бинарь `rampart` и stub-бэкенд (socat echo) в одном контейнере.
|
||||
|
||||
## Топология
|
||||
|
||||
|
|
@ -9,7 +9,7 @@
|
|||
│ docker bridge 172.30.0.0/24 │
|
||||
│ │
|
||||
│ rampart-edge (172.30.0.2) │
|
||||
│ ├─ rampart-core :25565 (bind 0.0.0.0)│
|
||||
│ ├─ rampart :25565 (bind 0.0.0.0)│
|
||||
│ ├─ socat echo :25566 (127.0.0.1) │ ← stub бэкенд
|
||||
│ └─ metrics :9090 │
|
||||
│ │
|
||||
|
|
@ -26,7 +26,7 @@
|
|||
```bash
|
||||
# 1. На VDS: клонировать репозиторий, собрать бинарь
|
||||
git clone https://github.com/loki5512344/rampart.git && cd rampart
|
||||
cargo build --release --bin rampart-core
|
||||
cargo build --release --bin rampart
|
||||
|
||||
# 2. Запустить весь цикл (setup + 4 фазы)
|
||||
# run-stress.sh сам найдёт бинарь (target/release), а папку — по себе (переменная DIR опциональна)
|
||||
|
|
@ -40,21 +40,19 @@ bash run-stress.sh
|
|||
|
||||
| Фаза | Конфиг | Что делает | Проверяет |
|
||||
|------|--------|-----------|-----------|
|
||||
| A | `edge-high.toml` (лимиты 100k) | флуд валидными handshake с 100 IP | сырую пропускную способность L7 |
|
||||
| B | `edge-defense.toml` (дефолт 5 pps/IP) | та же атака | rate limit + reputation ban, доступность легитимных клиентов |
|
||||
| A | `edge-high.toml` (лимиты 100k) | TCP connect flood со 100 IP | сырую пропускную способность L4 |
|
||||
| B | `edge-defense.toml` (дефолтные лимиты) | та же атака | rate limit + reputation ban, доступность легитимных клиентов |
|
||||
| C | — | SYN flood hping3 (rand-source) | поведение без XDP (обрабатывает kernel) |
|
||||
| D | `edge-high.toml` | 300 keepalive-коннектов | удержание активных соединений |
|
||||
|
||||
Во время фаз A и B параллельно подключается `legit.py` (легитимные MC клиенты), меряющий RTT — доказывает, что реальные игроки проходят во время атаки.
|
||||
Во время фаз A и B параллельно подключается `legit.py` (generic TCP-клиенты), меряющий RTT — доказывает, что реальные клиенты проходят во время атаки.
|
||||
|
||||
## Атака маскируется под обычный трафик
|
||||
## Атаки
|
||||
|
||||
`flood.py` шлёт **валидные** Minecraft handshake (протокол 767, packet id 0x00) со случайными hostname из пула (`play.example.com`, `mc.example.com`, ...) и ждёт ответ бэкенда — на уровне L7 флуд неотличим от легитимного клиента. Различие даёт только per-IP rate limit и репутация.
|
||||
`flood.py` открывает чистые TCP-соединения (connect / slowloris / keepalive режимы) со случайных source IP. Никакой протокольной маскировки нет: на уровне L3/L4 флуд неотличим от легитимного трафика. Различие даёт только per-IP rate limit и репутация.
|
||||
|
||||
## Метрики для сбора
|
||||
|
||||
```bash
|
||||
curl -s http://127.0.0.1:9090/metrics | grep -E 'rampart_(connections_total|pow_challenges|attack_status)'
|
||||
curl -s http://127.0.0.1:9090/metrics | grep -E 'rampart_(connections_total|rate_limit_hits|attack_status)'
|
||||
```
|
||||
|
||||
См. [load-test-report.md](../../research/load-test-report.md) — результаты прогона на VDS (2026-08-04).
|
||||
|
|
|
|||
4
deploy/test/stress/attacker.Dockerfile
Normal file
4
deploy/test/stress/attacker.Dockerfile
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
FROM debian:bookworm-slim
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
python3 hping3 iproute2 ca-certificates && rm -rf /var/lib/apt/lists/*
|
||||
CMD ["sleep", "infinity"]
|
||||
|
|
@ -3,11 +3,7 @@ address = "0.0.0.0"
|
|||
port = 25565
|
||||
|
||||
[backend]
|
||||
address = "127.0.0.1"
|
||||
port = 25566
|
||||
|
||||
[hmac]
|
||||
secret = "test_secret_32_bytes_long_for_integration_test"
|
||||
upstreams = ["127.0.0.1:25566"]
|
||||
|
||||
[workers]
|
||||
count = 2
|
||||
|
|
@ -15,22 +11,21 @@ count = 2
|
|||
[limits]
|
||||
handshake_timeout_secs = 5
|
||||
max_connections_per_ip = 10
|
||||
rate_limit_status_pps = 2
|
||||
rate_limit_login_pps = 5
|
||||
rate_limit_burst = 10
|
||||
rate_limit_pps = 2.0
|
||||
rate_limit_burst = 10.0
|
||||
|
||||
[ban]
|
||||
ban_duration_secs = 3600
|
||||
|
||||
[store]
|
||||
redis_url = ""
|
||||
blacklist_cache_ttl_secs = 300
|
||||
clickhouse_url = ""
|
||||
|
||||
[xdp]
|
||||
enabled = false
|
||||
interface = "eth0"
|
||||
|
||||
[death_code]
|
||||
enabled = true
|
||||
ban_duration_secs = 3600
|
||||
|
||||
[metrics]
|
||||
enabled = true
|
||||
port = 9090
|
||||
|
|
|
|||
|
|
@ -3,11 +3,7 @@ address = "0.0.0.0"
|
|||
port = 25565
|
||||
|
||||
[backend]
|
||||
address = "127.0.0.1"
|
||||
port = 25566
|
||||
|
||||
[hmac]
|
||||
secret = "test_secret_32_bytes_long_for_integration_test"
|
||||
upstreams = ["127.0.0.1:25566"]
|
||||
|
||||
[workers]
|
||||
count = 2
|
||||
|
|
@ -15,22 +11,18 @@ count = 2
|
|||
[limits]
|
||||
handshake_timeout_secs = 5
|
||||
max_connections_per_ip = 100000
|
||||
rate_limit_status_pps = 100000
|
||||
rate_limit_login_pps = 100000
|
||||
rate_limit_burst = 100000
|
||||
rate_limit_pps = 100000.0
|
||||
rate_limit_burst = 100000.0
|
||||
|
||||
[store]
|
||||
redis_url = ""
|
||||
blacklist_cache_ttl_secs = 300
|
||||
clickhouse_url = ""
|
||||
|
||||
[xdp]
|
||||
enabled = false
|
||||
interface = "eth0"
|
||||
|
||||
[death_code]
|
||||
enabled = true
|
||||
ban_duration_secs = 3600
|
||||
|
||||
[metrics]
|
||||
enabled = true
|
||||
port = 9090
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
FROM debian:bookworm-slim
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends socat ca-certificates && rm -rf /var/lib/apt/lists/*
|
||||
COPY rampart-core /usr/local/bin/rampart-core
|
||||
COPY rampart /usr/local/bin/rampart
|
||||
COPY start.sh /start.sh
|
||||
RUN chmod +x /start.sh
|
||||
EXPOSE 25565 9090
|
||||
|
|
|
|||
|
|
@ -1,63 +1,24 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Много-IP Minecraft stress generator, маскирующийся под обычный трафик.
|
||||
"""Много-IP TCP stress generator.
|
||||
|
||||
Отправляет валидные MC handshake с рандомными hostname из разных source IP
|
||||
(--ips-start..--ips-end должны быть назначены на eth0 контейнера).
|
||||
Открывает TCP-соединения с разных source IP (--ips-start..--ips-end должны
|
||||
быть назначены на eth0 контейнера). Без маскировки под конкретный протокол:
|
||||
флуд неотличим от обычных TCP-коннектов на уровне L3/L4, различие даёт
|
||||
только per-IP rate limit и репутация на edge.
|
||||
|
||||
Modes:
|
||||
connect - TCP connect + close (conn/s flood)
|
||||
handshake - валидный MC handshake + ждём ответ backend (маскировка под клиента)
|
||||
status - status-ping handshake (state 1)
|
||||
slowloris - connect + 1 байт + hold
|
||||
keepalive - connect + handshake + держим соединение
|
||||
slowloris - connect + 1 байт + hold (медленные соединения)
|
||||
keepalive - connect + держим соединение открытым
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import random
|
||||
import socket
|
||||
import struct
|
||||
import threading
|
||||
import time
|
||||
from datetime import datetime
|
||||
|
||||
HOSTS = [
|
||||
"play.example.com",
|
||||
"mc.example.com",
|
||||
"lobby.example.com",
|
||||
"hub.example.com",
|
||||
"survival.example.com",
|
||||
"skyblock.example.com",
|
||||
"bedwars.example.com",
|
||||
"minigames.example.com",
|
||||
"vip.example.com",
|
||||
]
|
||||
PROTOCOL = 767
|
||||
|
||||
|
||||
def pack_varint(value):
|
||||
buf = []
|
||||
while True:
|
||||
byte = value & 0x7F
|
||||
value >>= 7
|
||||
if value:
|
||||
byte |= 0x80
|
||||
buf.append(byte)
|
||||
if not value:
|
||||
break
|
||||
return bytes(buf)
|
||||
|
||||
|
||||
def make_handshake(state=2, host=None):
|
||||
host = host or random.choice(HOSTS)
|
||||
pkt = bytearray()
|
||||
pkt.extend(pack_varint(0)) # packet ID 0x00
|
||||
pkt.extend(pack_varint(PROTOCOL))
|
||||
pkt.extend(pack_varint(len(host)))
|
||||
pkt.extend(host.encode())
|
||||
pkt.extend(struct.pack(">H", 25565))
|
||||
pkt.extend(pack_varint(state))
|
||||
return pack_varint(len(pkt)) + bytes(pkt)
|
||||
|
||||
|
||||
def parse_args():
|
||||
p = argparse.ArgumentParser()
|
||||
|
|
@ -65,8 +26,8 @@ def parse_args():
|
|||
p.add_argument("--port", type=int, default=25565)
|
||||
p.add_argument(
|
||||
"--mode",
|
||||
choices=["connect", "handshake", "status", "slowloris", "keepalive"],
|
||||
default="handshake",
|
||||
choices=["connect", "slowloris", "keepalive"],
|
||||
default="connect",
|
||||
)
|
||||
p.add_argument("--duration", type=int, default=30)
|
||||
p.add_argument("--threads", type=int, default=100)
|
||||
|
|
@ -92,31 +53,25 @@ def main():
|
|||
s.bind((src, 0))
|
||||
s.settimeout(args.timeout)
|
||||
s.connect((args.target, args.port))
|
||||
if args.mode == "handshake":
|
||||
s.sendall(make_handshake())
|
||||
try:
|
||||
s.recv(1)
|
||||
except socket.timeout:
|
||||
pass
|
||||
elif args.mode == "status":
|
||||
s.sendall(make_handshake(state=1))
|
||||
try:
|
||||
s.recv(1)
|
||||
except socket.timeout:
|
||||
pass
|
||||
if args.mode == "connect":
|
||||
pass
|
||||
elif args.mode == "slowloris":
|
||||
s.sendall(b"\x01")
|
||||
time.sleep(30)
|
||||
try:
|
||||
s.sendall(b"\x01")
|
||||
time.sleep(30)
|
||||
except OSError:
|
||||
pass
|
||||
elif args.mode == "keepalive":
|
||||
s.sendall(make_handshake())
|
||||
time.sleep(30)
|
||||
try:
|
||||
time.sleep(30)
|
||||
except OSError:
|
||||
pass
|
||||
with stats["lock"]:
|
||||
stats["sent"] += 1
|
||||
s.close()
|
||||
if args.mode == "connect":
|
||||
s.close()
|
||||
except OSError:
|
||||
pass
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
threads = [
|
||||
threading.Thread(target=worker, daemon=True) for _ in range(args.threads)
|
||||
|
|
|
|||
|
|
@ -1,36 +1,11 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Легитимный Minecraft клиент: подключается ВО ВРЕМЯ DDoS и меряет RTT."""
|
||||
"""Generic TCP-клиент: подключается ВО ВРЕМЯ DDoS и меряет RTT."""
|
||||
|
||||
import argparse
|
||||
import socket
|
||||
import struct
|
||||
import time
|
||||
|
||||
|
||||
def pack_varint(value):
|
||||
buf = []
|
||||
while True:
|
||||
byte = value & 0x7F
|
||||
value >>= 7
|
||||
if value:
|
||||
byte |= 0x80
|
||||
buf.append(byte)
|
||||
if not value:
|
||||
break
|
||||
return bytes(buf)
|
||||
|
||||
|
||||
def make_handshake(host="play.example.com", port=25565, state=2):
|
||||
pkt = bytearray()
|
||||
pkt.extend(pack_varint(0))
|
||||
pkt.extend(pack_varint(767))
|
||||
pkt.extend(pack_varint(len(host)))
|
||||
pkt.extend(host.encode())
|
||||
pkt.extend(struct.pack(">H", port))
|
||||
pkt.extend(pack_varint(state))
|
||||
return pack_varint(len(pkt)) + bytes(pkt)
|
||||
|
||||
|
||||
def main():
|
||||
p = argparse.ArgumentParser()
|
||||
p.add_argument("--target", default="127.0.0.1")
|
||||
|
|
@ -47,7 +22,7 @@ def main():
|
|||
try:
|
||||
s = socket.create_connection((args.target, args.port), timeout=args.timeout)
|
||||
s.settimeout(args.timeout)
|
||||
s.sendall(make_handshake())
|
||||
# Ждём первый байт от edge (PoW challenge / upstream-ответ).
|
||||
resp = s.recv(1)
|
||||
rtt = (time.time() - t0) * 1000
|
||||
ok = len(resp) > 0
|
||||
|
|
|
|||
|
|
@ -48,8 +48,8 @@ run_flood_phase() {
|
|||
local ba bb bp
|
||||
ba=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
bb=$(mget 'rampart_connections_total{result="blocked"}')
|
||||
bp=$(mget 'rampart_pow_challenges_total{result="failed"}')
|
||||
echo "baseline: allowed=$ba blocked=$bb pow_fail=$bp"
|
||||
bp=$(mget 'rampart_rate_limit_hits')
|
||||
echo "baseline: allowed=$ba blocked=$bb rate_limit_hits=$bp"
|
||||
|
||||
docker exec rampart-attacker python3 /flood.py \
|
||||
--target "$EDGE_IP" --port 25565 --mode "$mode" \
|
||||
|
|
@ -68,10 +68,10 @@ run_flood_phase() {
|
|||
local a bl p s cpu
|
||||
a=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
bl=$(mget 'rampart_connections_total{result="blocked"}')
|
||||
p=$(mget 'rampart_pow_challenges_total{result="failed"}')
|
||||
p=$(mget 'rampart_rate_limit_hits')
|
||||
s=$(mget 'rampart_attack_status ')
|
||||
cpu=$(edge_cpu)
|
||||
echo " [t=${i}x5s] status=$s cpu=$cpu allowed=+$((a - ba)) blocked=+$((bl - bb)) pow_fail=+$((p - bp))"
|
||||
echo " [t=${i}x5s] status=$s cpu=$cpu allowed=+$((a - ba)) blocked=+$((bl - bb)) rate_limit_hits=+$((p - bp))"
|
||||
done
|
||||
|
||||
wait "$flood_pid" || true
|
||||
|
|
@ -80,14 +80,14 @@ run_flood_phase() {
|
|||
local ea eb ep es ec
|
||||
ea=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
eb=$(mget 'rampart_connections_total{result="blocked"}')
|
||||
ep=$(mget 'rampart_pow_challenges_total{result="failed"}')
|
||||
ep=$(mget 'rampart_rate_limit_hits')
|
||||
es=$(mget 'rampart_attack_status ')
|
||||
ec=$(edge_cpu)
|
||||
echo "--- итог фазы $phase ---"
|
||||
echo " attack_status=$es cpu=$ec"
|
||||
echo " allowed: $((ea - ba)) (+$(( (ea - ba) / duration ))/s)"
|
||||
echo " blocked: $((eb - bb)) (+$(( (eb - bb) / duration ))/s)"
|
||||
echo " pow_fail: $((ep - bp))"
|
||||
echo " rate_limit_hits: $((ep - bp))"
|
||||
echo "--- легитимные клиенты во время фазы ---"
|
||||
grep -E '^\[phase' /tmp/legit_$phase.log || true
|
||||
echo ""
|
||||
|
|
@ -101,12 +101,12 @@ docker network create --subnet "$SUB" "$NET" >/dev/null
|
|||
# Подготовка контекстов: бинарь ищем в target/release репозитория
|
||||
mkdir -p "$DIR/edge-ctx" "$DIR/attacker-ctx"
|
||||
cp "$DIR/flood.py" "$DIR/attacker-ctx/flood.py" 2>/dev/null || true
|
||||
if [ ! -f "$DIR/edge-ctx/rampart-core" ]; then
|
||||
for p in "$DIR/rampart-core" "$DIR/repo/target/release/rampart-core" "$DIR/../target/release/rampart-core"; do
|
||||
if [ -f "$p" ]; then cp "$p" "$DIR/edge-ctx/rampart-core"; break; fi
|
||||
if [ ! -f "$DIR/edge-ctx/rampart" ]; then
|
||||
for p in "$DIR/rampart" "$DIR/repo/target/release/rampart" "$DIR/../../target/release/rampart"; do
|
||||
if [ -f "$p" ]; then cp "$p" "$DIR/edge-ctx/rampart"; break; fi
|
||||
done
|
||||
fi
|
||||
[ -f "$DIR/edge-ctx/rampart-core" ] || { echo "ERROR: rampart-core не найден. Собери: cargo build --release --bin rampart-core" >&2; exit 1; }
|
||||
[ -f "$DIR/edge-ctx/rampart" ] || { echo "ERROR: rampart не найден. Собери: cargo build --release --bin rampart" >&2; exit 1; }
|
||||
|
||||
docker build -q -f "$DIR/edge.Dockerfile" -t rampart-edge "$DIR/edge-ctx"
|
||||
docker build -q -f "$DIR/attacker.Dockerfile" -t rampart-attacker "$DIR/attacker-ctx"
|
||||
|
|
@ -124,34 +124,30 @@ docker exec rampart-attacker sh -c '
|
|||
|
||||
echo ""
|
||||
echo "############### PHASE A: СЫРАЯ ПРОПУСКНАЯ СПОСОБНОСТЬ ###############"
|
||||
echo "############### (лимиты сняты: 100k pps, 100 src IP, валидные handshake) ###############"
|
||||
run_flood_phase A edge-high.toml 30 handshake 100 "$IPS_END" "raw throughput, 100 IP flood, valid handshake"
|
||||
echo "############### (лимиты сняты: 100k conn/s, 100 src IP, TCP connect flood) ###############"
|
||||
run_flood_phase A edge-high.toml 30 connect 100 "$IPS_END" "raw throughput, 100 IP TCP connect flood"
|
||||
|
||||
echo ""
|
||||
echo "############### PHASE B: ЗАЩИТА (дефолтные лимиты 5 pps/IP) ###############"
|
||||
echo "############### PHASE B: ЗАЩИТА (дефолтные лимиты 2 pps/IP) ###############"
|
||||
echo "############### (та же атака, но теперь edge режет по IP; легитимные клиенты заходят) ###############"
|
||||
run_flood_phase B edge-defense.toml 30 handshake 100 "$IPS_END" "defense, rate limit 5pps/IP + reputation bans"
|
||||
run_flood_phase B edge-defense.toml 30 connect 100 "$IPS_END" "defense, rate limit + reputation bans"
|
||||
|
||||
echo ""
|
||||
echo "############### PHASE C: SYN flood ###############"
|
||||
echo "=============================================================="
|
||||
echo "ФАЗА C: SYN flood hping3 (rand-source, 20s)"
|
||||
echo "=============================================================="
|
||||
ba=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
bb=$(mget 'rampart_connections_total{result="blocked"}')
|
||||
timeout 20 docker exec rampart-attacker hping3 -S --flood --rand-source -p 25565 "$EDGE_IP" || true
|
||||
sleep 2
|
||||
ea=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
eb=$(mget 'rampart_connections_total{result="blocked"}')
|
||||
es=$(mget 'rampart_attack_status ')
|
||||
echo " attack_status=$es cpu=$(edge_cpu) allowed=+$((ea - ba)) blocked=+$((eb - bb))"
|
||||
echo " attack_status=$es cpu=$(edge_cpu)"
|
||||
echo " (SYN flood обрабатывается kernel'ом/XDP, L7 edge почти не задет)"
|
||||
echo ""
|
||||
|
||||
echo ""
|
||||
echo "############### PHASE D: активные соединения (keepalive) ###############"
|
||||
echo "=============================================================="
|
||||
echo "ФАЗА D: 300 keepalive коннектов (валидный handshake, держим открытым)"
|
||||
echo "ФАЗА D: 300 keepalive коннектов (держим открытыми)"
|
||||
echo "=============================================================="
|
||||
start_edge edge-high.toml
|
||||
ba=$(mget 'rampart_connections_total{result="allowed"}')
|
||||
|
|
@ -166,7 +162,7 @@ echo ""
|
|||
echo "=============================================================="
|
||||
echo "ИТОГОВЫЙ СВОД"
|
||||
echo "=============================================================="
|
||||
edge_metrics | grep -E 'connections_total|pow_challenges|attack_status'
|
||||
edge_metrics | grep -E 'connections_total|rate_limit_hits|attack_status'
|
||||
echo ""
|
||||
echo "CPU/память контейнеров:"
|
||||
docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}' rampart-edge rampart-attacker
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
#!/bin/sh
|
||||
# Stub backend (TCP echo) на 127.0.0.1:25566 для стресс-теста edge ноды.
|
||||
socat TCP-LISTEN:25566,fork,reuseaddr,bind=127.0.0.1 EXEC:'cat' &
|
||||
exec rampart-core --config /etc/rampart/config.toml
|
||||
export RAMPART_CONFIG=/etc/rampart/config.toml
|
||||
exec rampart
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue